README
¶
web-bot-auth Caddy Plugin
Caddy plugin extending Caddy configuration to allow for validation of web-bot-auth as defined in draft-meunier-webbotauth-httpsig-protocol.
Table of Contents
Features
This is an example plugin and only supports Ed25519. You can find a test key in Appendix B.1.4 of RFC 9421.
httpsigconfiguration hook- Load keys from a direct HTTP Message Signatures directory with
directory_base - Load keys from registry signature-agent cards with
registry - Load multiple inline keys, or multiple keys from
jwks_uri - Load IP allowlists from
ips_urias defined in draft-illyes-webbotauth-jafar-00 - Block request without a valid signature
Usage
First, you need to install xcaddy
go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
Then you build caddy
xcaddy build latest --with github.com/cloudflareresearch/web-bot-auth/examples/caddy-plugin=./
And finally, you run caddy
./caddy run --config Caddyfile
To generate a signed request, you can use the sibling browser extension.
directory_base is the direct directory mode. registry is experimental registry draft support and can be repeated. fail_on_load_error defaults to false; set it to true if Caddy should fail provisioning when directories, registries, cards, IP lists, or keys cannot be loaded.
Security Considerations
This software has not been audited. Please use at your sole discretion.
License
This project is under the Apache 2.0 license.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be Apache 2.0 licensed as above, without any additional terms or conditions.
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Directory ¶
type Directory struct {
Keys []json.RawMessage `json:"keys"`
}
type JAFARIPList ¶
type JAFARIPList struct {
Prefixes []JAFARPrefix `json:"prefixes"`
}
type JAFARPrefix ¶
type JWKSResponse ¶
type JWKSResponse struct {
Keys []json.RawMessage `json:"keys"`
}
type Middleware ¶
type Middleware struct {
DirectoryBase string `json:"directory_base,omitempty"`
RegistryURLs []string `json:"registry,omitempty"`
FailOnLoadError bool `json:"fail_on_load_error,omitempty"`
// contains filtered or unexported fields
}
func (Middleware) CaddyModule ¶
func (m Middleware) CaddyModule() caddy.ModuleInfo
func (*Middleware) ServeHTTP ¶
func (m *Middleware) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
func (*Middleware) UnmarshalCaddyfile ¶
func (m *Middleware) UnmarshalCaddyfile(d *caddyfile.Dispenser) error
type SignatureAgentCard ¶
type SignatureAgentCard struct {
JWKSUri *string `json:"jwks_uri"`
IPSUri *string `json:"ips_uri"`
Keys []json.RawMessage `json:"keys"`
}
type SignatureValidator ¶
type SignatureValidator struct {
// contains filtered or unexported fields
}
func NewValidator ¶
func NewValidator(keys keySpecs) (*SignatureValidator, error)
Source Files